A novel approach to scan detection on the backbone

ITNG 2009 - 6th International Conference on Information Technology: New Generations

Volumn , Issue , 2009, Pages 16-21

  Zhang, Yu ^a   Fang, Binxing ^b  

^a HARBIN INSTITUTE OF TECHNOLOGY   (China)

^b INSTITUTE OF COMPUTING TECHNOLOGY   (China)

Author keywords

Flow size distribution entropy; IP backbone monitoring; Port scanning; Real time port scan detection; Sequential hypothesis testing

Indexed keywords

FLOW SIZE DISTRIBUTION ENTROPY; FLOW SIZES; IP BACKBONE; PORT SCANNING; PORT SCANS; REAL TIME; SEQUENTIAL HYPOTHESIS TESTING;

COMPUTER CRIME; ENTROPY; INFORMATION TECHNOLOGY; INTERNET PROTOCOLS; PACKET NETWORKS; SCANNING; SIZE DETERMINATION; SIZE DISTRIBUTION;

PORTS AND HARBORS;

EID: 77951114448     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ITNG.2009.16     Document Type: Conference Paper

References (9)

1. M. Fullmer and S. Romig. The OSU Flow-tools Package and Cisco NetFlow Logs.
2. C. Gates, J. McNutt, J. Kadane, and M. Kellner. Scan detection on very large networks using logistic regression modeling. Proceedings of the IEEE Symposium on Computers and Communications, Pula-Cagliari, Sardinia, Italy, June, 2006.
3. A. Kumar, M. Sung, J. Xu, and J. Wang. Data streaming algorithms for efficient and accurate estimation of flow size distribution. Proceedings of the joint international conference on Measurement and modeling of computer systems, pages 177-188, 2004.
4. G. Simon. Scan Detection: A Data Mining Approach. Proceedings of the Sixth SIAM International Conference on Data Mining, pages 118-129, 2006.
5. A. Sridharan, T. Ye, and S. Bhattacharrya. Connectionless port scan detection on the backbone. Malware workshop, held in conjunction with IPCCC.
6. A. Sridharan, T. Ye, and C. Burlingame. Tracking Port Scanners on the IP Backbone.
7. S. Staniford, J. A. Hoagland, and J. M. McAlerney. Practical automated detection of stealthy portscans. J. Comput. Secur., 10(1-2):105-136, 2002.
8. N. Weaver, S. Staniford, and V. Paxson. Very Fast Containment of Scanning Worms.
9. V. Yegneswaran, P. Barford, and J. Ullrich. Internet intrusions: global characteristics and prevalence. Proceedings of the 2003 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, pages 138-147, 2003.